Fake Microsoft 365 outage emails threaten to delete your held mail

Got an email saying mail held up in this week’s Microsoft 365 outage will be deleted in 24 hours unless you click? It’s a scam. Don’t click it.

Microsoft Threat Intelligence, the company’s security research team, posted a warning on LinkedIn on Saturday. It says scammers are dressing up phishing emails as Microsoft 365 service health notices about the outage.

The timing is sharp. The outage really did hold up mail, as we reported in Microsoft 365 outage is over, and the email backlog is cleared. Microsoft’s final status update said the backlog had been processed. Nothing is waiting for you to rescue it.

A real incident number, a fake deadline

The emails borrow details from the genuine outage to look official.

• They quote a real incident ID. The emails reference EX1550543, the actual Exchange Online incident number from the outage.
• The subject line has a code. Subjects follow the pattern “Outage -” followed by six characters.
• The sender name looks internal. It starts with something specific to your organisation, then “Outage Notification” or “Service Health”.
• There’s a countdown. Some versions, seen on 13 November, say messages held during the outage will be deleted within 24 hours unless you click to restore them.

That 24-hour threat is the giveaway. It’s designed to make you click before you think.

What happens if you click

Microsoft says the activity is consistent with credential phishing, which aims to steal sign-in details. It adds that it hasn’t confirmed any being collected, or malware being delivered.

Microsoft saw similar emails aimed at organisations across several US sectors. It hasn’t said whether any reached Australian inboxes. The outage they exploit hit Australian users too.

For IT people, Microsoft lists three sender domains: moments-notice[.]com, planetmaison[.]com and newbooker[.]com. Each email’s link is a SendGrid click-tracking link made for that recipient. It redirects to reallifeaccounting[.]com. Microsoft says its Defender products block the domains and quarantine the emails.

Check outages at the source

Microsoft’s advice is simple: confirm any service problem directly through the Microsoft 365 admin centre. Our advice: don’t use a link in an email to get there.

In the admin centre, the Health menu has a Service health page. Its Issue history tab lists incidents resolved in the last 7 or 30 days. People with an admin, Service Support admin or Helpdesk admin role can see it. Everyone else can ask whoever looks after their IT.

If you typed your password into a page after clicking, treat it as a hacked account. Our guide, Your business email has been hacked: what to do in the first hour, walks through the steps.

Checklist

• Delete any “Outage” email asking you to restore messages. Microsoft says the outage’s email backlog has been processed, so there’s nothing to restore.
• Tell your team. Warn staff that fake Microsoft 365 outage notices are circulating, and that the outage is over and its email backlog cleared.
• Check outages in the admin centre. Open Health, then Service health, at admin.microsoft.com rather than following a link in an email, or ask whoever runs your IT.
• Ask your IT provider to block the sender domains. Give them moments-notice[.]com, planetmaison[.]com, newbooker[.]com and reallifeaccounting[.]com.
• Ask your IT provider to check for clicks. Microsoft suggests Defender’s Threat Explorer and advanced hunting to find these emails and who clicked them, and checking Safe Links policies.
• Change your password if you entered it. Then follow the first-hour steps for a hacked business email account.
• Report it to Scamwatch. Use the form at scamwatch.gov.au/report-a-scam.